@envseal/protocol 0.1.5 → 0.1.6

package/dist/errors.d.ts

@@ -1,4 +1,4 @@
-export declare const SEP_ERROR_CODES: readonly ["SEP_UNKNOWN_KEY", "SEP_NOT_DECLARED", "SEP_NO_INTERACTIVE_SURFACE", "SEP_TICKET_EXPIRED", "SEP_TICKET_UNKNOWN", "SEP_USER_CANCELLED", "SEP_FORMAT_INVALID", "SEP_SINK_UNAVAILABLE", "SEP_SINK_WRITE_FAILED", "SEP_PROBE_NOT_APPROVED", "SEP_VALUE_IN_REQUEST", "SEP_GITIGNORE_UNSAFE", "SEP_CONFIRMATION_DENIED", "SEP_RATE_LIMITED", "SEP_TARGET_CHANGED", "SEP_PATTERN_UNSAFE", "SEP_KEYS_MISSING"];
+export declare const SEP_ERROR_CODES: readonly ["SEP_UNKNOWN_KEY", "SEP_NOT_DECLARED", "SEP_NO_INTERACTIVE_SURFACE", "SEP_TICKET_EXPIRED", "SEP_TICKET_UNKNOWN", "SEP_USER_CANCELLED", "SEP_FORMAT_INVALID", "SEP_SINK_UNAVAILABLE", "SEP_SINK_WRITE_FAILED", "SEP_PROBE_NOT_APPROVED", "SEP_VALUE_IN_REQUEST", "SEP_GITIGNORE_UNSAFE", "SEP_CONFIRMATION_DENIED", "SEP_RATE_LIMITED", "SEP_TARGET_CHANGED", "SEP_EGRESS_DENIED", "SEP_PATTERN_UNSAFE", "SEP_KEYS_MISSING"];
 export type SepErrorCode = (typeof SEP_ERROR_CODES)[number];
 export interface SepErrorDefaults {
     retriable: boolean;

package/dist/errors.js

@@ -14,6 +14,7 @@ export const SEP_ERROR_CODES = [
     'SEP_CONFIRMATION_DENIED',
     'SEP_RATE_LIMITED',
     'SEP_TARGET_CHANGED',
+    'SEP_EGRESS_DENIED',
     'SEP_PATTERN_UNSAFE',
     'SEP_KEYS_MISSING',
 ];
@@ -79,6 +80,11 @@ export const SEP_ERROR_DEFAULTS = {
         userMessage: 'The program to run changed on disk after you approved it. Nothing was executed. ' +
             'Re-run the command to review the current content and approve it again.',
     },
+    SEP_EGRESS_DENIED: {
+        retriable: false,
+        userMessage: 'This project uses an egress allowlist, and the command targets a host that is not on it. ' +
+            'Nothing was executed or sent. To allow the host, add it to policy.egress.allow in env.schema.jsonc.',
+    },
     SEP_PATTERN_UNSAFE: {
         retriable: false,
         userMessage: 'The declared format.pattern is unsafe or too complex. Use a shorter, bounded pattern (for example ^sk-[A-Za-z0-9]{20,80}$).',

package/dist/schemas.d.ts

@@ -188,6 +188,36 @@ export declare const ManifestEntry: z.ZodEffects<z.ZodObject<{
     } | undefined;
 }>;
 export type ManifestEntry = z.infer<typeof ManifestEntry>;
+/**
+ * policy.egress — declarative egress restriction for env_use (SEP/1 minor
+ * addition). mode 'warn' (default when policy is absent) preserves historical
+ * behavior: network-touching commands draw an extra warning in the consent
+ * dialog. mode 'allowlist' hard-refuses any network command whose target host
+ * is not listed, BEFORE any dialog opens. The override path is deliberately
+ * editing this file rather than clicking a dialog: a prompt-injected agent
+ * cannot talk the user past a control that does not exist mid-flow.
+ *
+ * Allow entries are hostnames or single-label wildcards ('*.openai.com').
+ * URLs, ports, and schemes are rejected here so the enforcement layer can
+ * trust entries blindly.
+ */
+export declare const EgressPolicy: z.ZodEffects<z.ZodObject<{
+    mode: z.ZodEnum<["warn", "allowlist"]>;
+    allow: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
+}, "strict", z.ZodTypeAny, {
+    mode: "warn" | "allowlist";
+    allow: string[];
+}, {
+    mode: "warn" | "allowlist";
+    allow?: string[] | undefined;
+}>, {
+    mode: "warn" | "allowlist";
+    allow: string[];
+}, {
+    mode: "warn" | "allowlist";
+    allow?: string[] | undefined;
+}>;
+export type EgressPolicy = z.infer<typeof EgressPolicy>;
 export declare const Manifest: z.ZodObject<{
     $schema: z.ZodOptional<z.ZodString>;
     version: z.ZodLiteral<1>;
@@ -375,6 +405,34 @@ export declare const Manifest: z.ZodObject<{
             maxAgeDays: number;
         } | undefined;
     }>, "many">>;
+    policy: z.ZodOptional<z.ZodObject<{
+        egress: z.ZodEffects<z.ZodObject<{
+            mode: z.ZodEnum<["warn", "allowlist"]>;
+            allow: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
+        }, "strict", z.ZodTypeAny, {
+            mode: "warn" | "allowlist";
+            allow: string[];
+        }, {
+            mode: "warn" | "allowlist";
+            allow?: string[] | undefined;
+        }>, {
+            mode: "warn" | "allowlist";
+            allow: string[];
+        }, {
+            mode: "warn" | "allowlist";
+            allow?: string[] | undefined;
+        }>;
+    }, "strict", z.ZodTypeAny, {
+        egress: {
+            mode: "warn" | "allowlist";
+            allow: string[];
+        };
+    }, {
+        egress: {
+            mode: "warn" | "allowlist";
+            allow?: string[] | undefined;
+        };
+    }>>;
 }, "strict", z.ZodTypeAny, {
     entries: {
         key: string;
@@ -408,6 +466,12 @@ export declare const Manifest: z.ZodObject<{
     }[];
     version: 1;
     $schema?: string | undefined;
+    policy?: {
+        egress: {
+            mode: "warn" | "allowlist";
+            allow: string[];
+        };
+    } | undefined;
 }, {
     version: 1;
     entries?: {
@@ -441,6 +505,12 @@ export declare const Manifest: z.ZodObject<{
         } | undefined;
     }[] | undefined;
     $schema?: string | undefined;
+    policy?: {
+        egress: {
+            mode: "warn" | "allowlist";
+            allow?: string[] | undefined;
+        };
+    } | undefined;
 }>;
 export type Manifest = z.infer<typeof Manifest>;
 export declare const KeyStatus: z.ZodObject<{

package/dist/schemas.js

@@ -253,11 +253,50 @@ export const ManifestEntry = z
         });
     }
 });
+/**
+ * policy.egress — declarative egress restriction for env_use (SEP/1 minor
+ * addition). mode 'warn' (default when policy is absent) preserves historical
+ * behavior: network-touching commands draw an extra warning in the consent
+ * dialog. mode 'allowlist' hard-refuses any network command whose target host
+ * is not listed, BEFORE any dialog opens. The override path is deliberately
+ * editing this file rather than clicking a dialog: a prompt-injected agent
+ * cannot talk the user past a control that does not exist mid-flow.
+ *
+ * Allow entries are hostnames or single-label wildcards ('*.openai.com').
+ * URLs, ports, and schemes are rejected here so the enforcement layer can
+ * trust entries blindly.
+ */
+export const EgressPolicy = z
+    .object({
+    mode: z.enum(['warn', 'allowlist']),
+    allow: z.array(z.string()).default([]),
+})
+    .strict()
+    .superRefine((policy, ctx) => {
+    if (policy.mode === 'allowlist' && policy.allow.length === 0) {
+        ctx.addIssue({
+            code: z.ZodIssueCode.custom,
+            path: ['allow'],
+            message: 'mode "allowlist" requires at least one entry in allow',
+        });
+    }
+    const HOST_PATTERN = /^(\*\.)?[a-z0-9]([a-z0-9-]*[a-z0-9])?(\.[a-z0-9]([a-z0-9-]*[a-z0-9])?)*$/i;
+    for (const [i, entry] of policy.allow.entries()) {
+        if (!HOST_PATTERN.test(entry)) {
+            ctx.addIssue({
+                code: z.ZodIssueCode.custom,
+                path: ['allow', i],
+                message: 'allow entries must be hostnames or "*.suffix" wildcards — no URLs, ports, schemes, or paths',
+            });
+        }
+    }
+});
 export const Manifest = z
     .object({
     $schema: z.string().optional(),
     version: z.literal(1),
     entries: z.array(ManifestEntry).default([]),
+    policy: z.object({ egress: EgressPolicy }).strict().optional(),
 })
     .strict();
 export const KeyStatus = z

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@envseal/protocol",
-  "version": "0.1.5",
+  "version": "0.1.6",
   "type": "module",
   "license": "Apache-2.0",
   "main": "./dist/index.js",